The Navy wants to increase its collaboration in the cyber domain with allies and other international partners to improve interoperability and the sharing of tactics.
The department’s first cyber strategy, released in November, calls for greater cooperation between the organization and foreign countries.
“We will engage with Allied and friendly nations to exchange best practices, share appropriate information, and coordinate our efforts in cyberspace,” it states.
Officials noted that there is a lot to be gained, in terms of tactics and tools, through greater partnership.
“We share our tools, we share the intelligence — and so the better integrated we are, the more successful we will be. A big part of this, again, is learning from each other. We learn as much from them as they learned from us,” Scott St. Pierre, the Department of the Navy’s acting principal cyber advisor, told reporters during a media call Friday. “Our allied coalition partners bring intelligence, they bring unique ways of looking at both defensive cyber operations as well as offensive cyber operations.”
Officials in the past have noted that in many cases, allies and partners may have certain capabilities, access and even authorities that are not immediately available to the U.S. Teaming up with these nations to understand capabilities, accesses and targets improves operations because in some cases these countries can act when the U.S. might not be able to.
St. Pierre noted that this push for greater international cooperation is in line with efforts by U.S. Cyber Command.
“That integrated approach is one of the key elements that U.S. Cyber Command is working, as well as each of the component cyber commands,” he said. “They work with joint and allied partners every single day in a cooperative fashion. It’s been tremendously beneficial to help moving us forward not only on establishing the right defensive postures, but also learning from what they know in terms of the intel they collected and how they actually execute offensive cyber operations.”
In fact, Cybercom’s leader Gen. Paul Nakasone has made international partnerships a key pillar of the…
The U.S. Federal Bureau of Investigation (FBI), U.S. Cybersecurity & Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), Polish Military Counterintelligence Service (SKW), CERT Polska (CERT.PL), and the UK’s National Cyber Security Centre (NCSC) assess Russian Foreign Intelligence Service (SVR) cyber actors—also known as Advanced Persistent Threat 29 (APT 29), the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard—are exploiting CVE-2023-42793 at a large scale, targeting servers hosting JetBrains TeamCity software since September 2023.
Software developers use TeamCity software to manage and automate software compilation, building, testing, and releasing. If compromised, access to a TeamCity server would provide malicious actors with access to that software developer’s source code, signing certificates, and the ability to subvert software compilation and deployment processes—access a malicious actor could further use to conduct supply chain operations. Although the SVR used such access to compromise SolarWinds and its customers in 2020, limited number and seemingly opportunistic types of victims currently identified, indicate that the SVR has not used the access afforded by the TeamCity CVE in a similar manner. The SVR has, however, been observed using the initial access gleaned by exploiting the TeamCity CVE to escalate its privileges, move laterally, deploy additional backdoors, and take other steps to ensure persistent and long-term access to the compromised network environments.
To bring Russia’s actions to public attention, the authoring agencies are providing information on the SVR’s most recent compromise to aid organizations in conducting their own investigations and securing their networks, provide compromised entities with actionable indicators of compromise (IOCs), and empower private sector cybersecurity companies to better detect and counter the SVR’s malicious actions. The authoring agencies recommend all organizations with affected systems that did not immediately apply available patches or workarounds to assume compromise and initiate threat hunting activities using the IOCs provided in this CSA. If potential compromise is detected, administrators should apply the incident response recommendations included in this CSA and report key findings to the FBI and CISA.
Download the PDF version of this report:
For a downloadable copy of IOCs, see:
THREAT OVERVIEW
SVR cyber operations pose a persistent threat to public and private organizations’ networks globally. Since 2013, cybersecurity companies and governments have reported on SVR operations targeting victim networks to steal confidential and proprietary information. A decade later, the authoring agencies can infer a long-term targeting pattern aimed at collecting, and enabling the collection of, foreign intelligence, a broad concept that for Russia encompasses information on the politics, economics, and military of foreign states; science and technology; and foreign counterintelligence. The SVR also conducts cyber operations targeting technology companies that enable future cyber operations.
A decade ago, public reports about SVR cyber activity focused largely on the SVR’s spear phishing operations, targeting government agencies, think tanks and policy analysis organizations, educational institutions, and political organizations. This category of targeting is consistent with the SVR’s responsibility to collect political intelligence, the collection of which has long been the SVR’s highest priority. For the Russian Government, political intelligence includes not only the development and execution of foreign policies, but also the development and execution of domestic policies and the political processes that drive them. In December 2016, the U.S. Government published a Joint Analysis Report titled “GRIZZLY STEPPE – Russian Malicious Cyber Activity,” which describes the SVR’s compromise of a U.S. political party leading up to a presidential election. The SVR’s use of spear phishing operations are visible today in its ongoing Diplomatic Orbiter campaign, primarily targeting diplomatic agencies. In 2023, SKW and CERT.PL published a Joint Analysis Report describing tools and techniques used by the SVR to target embassies in dozens of countries.
Less frequently, reporting on SVR cyber activity has addressed other aspects of the SVR’s foreign intelligence collection mission. In July 2020, U.S., U.K., and Canadian Governments jointly published an advisory revealing the SVR’s exploitation of CVEs to gain initial access to networks, and its deployment of custom malware known as WellMess, WellMail, and Sorefang to target organizations involved in COVID-19 vaccine development. Although not listed in the 2020 advisory did not mention it, the authoring agencies can now disclose that the SVR’s WellMess campaign also targeted energy companies. Such biomedical and energy targets are consistent with the SVR’s responsibility to support the Russian economy by pursuing two categories of foreign intelligence known as economic intelligence and science and technology.
In April 2021, the U.S. Government attributed a supply chain operation targeting the SolarWinds information technology company and its customers to the SVR. This attribution marked the discovery that the SVR had, since at least 2018, expanded the range of its cyber operations to include the widespread targeting of information technology companies. At least some of this targeting was aimed at enabling additional cyber operations. Following this attribution, the U.S. and U.K. Governments published advisories highlighting additional SVR TTPs, including its exploitation of various CVEs, the SVR’s use of “low and slow” password spraying techniques to gain initial access to some victims’ networks, exploitation of a zero-day exploit, and exploitation of Microsoft 365 cloud environments.
In this newly attributed operation targeting networks hosting TeamCity servers, the SVR demonstrably continues its practice of targeting technology companies. By choosing to exploit CVE-2023-42793, a software development program, the authoring agencies assess the SVR could benefit from access to victims, particularly by allowing the threat actors to compromise the networks of dozens of software developers. JetBrains issued a patch for this CVE in mid-September 2023, limiting the SVR’s operation to the exploitation of unpatched, Internet-reachable TeamCity servers. While the authoring agencies assess the SVR has not yet used its accesses to software developers to access customer networks and is likely still in the preparatory phase of its operation, having access to these companies’ networks presents the SVR with opportunities to enable hard-to- detect command and control (C2) infrastructure.
TECHNICAL DETAILS
Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 14. See the MITRE ATT&CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&CK® tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool. While SVR followed a similar playbook in each compromise, they also adjusted to each operating environment and not all presented steps or actions below were executed on every host.
Initial Access – Exploitation
The SVR started to exploit Internet-connected JetBrains TeamCity servers [T1190] in late September 2023 using CVE-2023-42793, which enables the insecure handling of specific paths allowing for bypassing authorization, resulting in arbitrary code execution on the server. The authoring agencies’ observations show that the TeamCity exploitation usually resulted in code execution [T1203] with high privileges granting the SVR an advantageous foothold in the network environment. The authoring agencies are not currently aware of any other initial access vector to JetBrains TeamCity currently being exploited by the SVR.
Host Reconnaissance
Initial observations show the SVR used the following basic, built-in commands to perform host reconnaissance [T1033],[T1059.003],[T1592.002]:
whoami /priv
whoami /all
whoami /groups
whoami /domain
nltest -dclist
nltest -dsgetdc
tasklist
netstat
wmic /node:””<redacted>”” /user:””<redacted>”” /password:””<redacted>”” process list brief
wmic /node:””<redacted>”” process list brief
wmic process get commandline -all
wmic process <proc_id> get commandline
wmic process where name=””GoogleCrashHandler64.exe”” get commandline,processed
Additionally, the authoring agencies have observed the SVR exfiltrating files [T1041] which may provide insight into the host system’s operating system:
C:\Windows\system32\ntoskrnl.exe to precisely identify system version, likely as a prerequisite to deploy EDRSandBlast.
SQL Server executable files – based on the review of the post exploitation actions, the SVR showed an interest in specific files of the SQL Server installed on the compromised systems:
Update management agent files – based on the review of the post exploitation actions, the SVR showed an interest in executables and configuration of patch management software:
SVR cyber actors also exfiltrated secforwarder.dll
Tactics Used to Avoid Detection
To avoid detection, the SVR used a “Bring Your Own Vulnerable Driver” [T1068] technique to disable or outright kill endpoint detection and response (EDR) and antivirus (AV) software [T1562.001].
This was done using an open source project called “EDRSandBlast.” The authoring agencies have observed the SVR using EDRSandBlast to remove protected process light (PPL) protection, which is used for controlling and protecting running processes and protecting them from infection. The actors then inject code into AV/EDR processes for a small subset of victims [T1068]. Additionally, executables that are likely to be detected (i.e. Mimikatz) were executed in memory [T1003.001].
In several cases SVR attempted to hide their backdoors via:
Abusing a DLL hijacking vulnerability in Zabbix software by replacing a legitimate Zabbix DLL with their one containing GraphicalProton backdoor,
Backdooring an open source application developed by Microsoft named vcperf. SVR modified and copied publicly available sourcecode. After execution, backdoored vcperf dropped several DLLs to disc, one of those being a GraphicalProton backdoor,
Abusing a DLL hijacking vulnerability in Webroot antivirus software by replacing a legitimate DLL with one containing GraphicalProton backdoor.
To avoid detection by network monitoring, the SVR devised a covert C2 channel that used Microsoft OneDrive and Dropbox cloud services. To further enable obfuscation, data exchanged with malware via OneDrive and Dropbox were hidden inside randomly generated BMP files [T1564], illustrated below:
Privilege Escalation
To facilitate privilege escalation [T1098], the SVR used multiple techniques, including WinPEAS, NoLMHash registry key modification, and the Mimikatz tool.
The SVR modified the NoLMHash registry using the following reg command:
The SVR used the following Mimikatz commands [T1003]:
privilege::debug
lsadump::cache
lsadump::secrets
lsadump::sam
sekurlsa::logonpasswords
Persistence
The SVR relied on scheduled tasks [T1053.005] to secure persistent execution of backdoors. Depending on the privileges the SVR had, their executables were stored in one of following directories:
C:\Windows\temp
C:\Windows\System32
C:\Windows\WinStore
The SVR made all modifications using the schtasks.exe binary. It then had multiple variants of arguments passed to schtasks.exe, which can be found in Appendix B – Indicators of Compromise.
To secure long-term access to the environment, the SVR used the Rubeus toolkit to craft Ticket Granting Tickets (TGTs) [T1558.001].
The SVR exfiltrated the following Windows Registry hives from its victims [T1003]:
HKLM\SYSTEM
HKLM\SAM
HKLM\SECURITY
In order to exfiltrate Windows Registry, the SVR saved hives into files [T1003.002], packed them, and then exfiltrated them using a backdoor capability. it used “reg save” to save SYSTEM, SAM and SECURITY registry hives, and used powershell to stage .zip archives in the C:\Windows\Temp\ directory.
reg save HKLM\SYSTEM “”C:\Windows\temp\1\sy.sa”” /y
reg save HKLM\SAM “”C:\Windows\temp\1\sam.sa”” /y
reg save HKLM\SECURITY “”C:\Windows\temp\1\se.sa”” /y
In a few specific cases, the SVR used the SharpChromium tool to obtain sensitive browser data such as session cookies, browsing history, or saved logins.
SVR also used DSInternals open source tool to interact with Directory Services. DSInternals allows to obtain a sensitive Domain information.
Network Reconnaissance
After the SVR built a secure foothold and gained an awareness of a victim’s TeamCity server, it then focused on network reconnaissance [T1590.004]. The SVR performed network reconnaissance using a mix of built-in commands and additional tools, such as port scanner and PowerSploit, which it launched into memory [T1046]. The SVR executed the following PowerSploit commands:
In selected environments the SVR used an additional tool named, “rr.exe”—a modified open source reverse socks tunneler named Rsockstun—to establish a tunnel to the C2 infrastructure [T1572].
The authoring agencies are aware of the following infrastructure used in conjunction with “rr.exe”:
65.20.97[.]203:443
Poetpages[.]com:8443
The SVR executed Rsockstun either in memory or using the Windows Management Instrumentation Command Line (WMIC) [T1047] utility after dropping it to disk:
In the course of the TeamCity operation, the SVR used multiple custom and open source available tools and backdoors. The following custom tools were observed in use during the operation:
GraphicalProton is a simplistic backdoor that uses OneDrive, Dropbox, and randomly generated BMPs [T1027.001] to exchange data with the SVR operator.
After execution, GraphicalProton gathers environment information such as active TCP/UDP connections [T1049], running processes [T1049], as well as user, host, and domain names [T1590]. OneDrive is used as a primary communication channel while Dropbox is treated as a backup channel [T1567]. API keys are hardcoded into the malware. When communicating with cloud services, GraphicalProton generates a randomly named directory which is used to store infection-specific BMP files – with both commands and results [T1564.001]. Directory name is re-randomized each time the GraphicalProton process is started.
BMP files that were used to exchange data were generated in the following way:
Compress data using zlib,
Encrypt data using custom algorithm,
Add “***” string literal to encrypted data,
Create a random BMP with random rectangle,
And finally, encode encrypted data within lower pixel bits.
While the GraphicalProton backdoor has remained mostly unchanged over the months we have been tracking it, to avoid detection the adversary wrapped the tool in various different layers of obfuscation, encryption, encoders, and stagers. Two specific variants of GraphicalProton “packaging” are especially noteworthy – a variant that uses DLL hijacking [T1574.002] in Zabbix as a means to start execution (and potentially provide long-term, hard-to-detect access) and a variant that masks itself within vcperf [T1036], an open-source C++ build analysis tool from Microsoft.
GraphicalProton HTTPS variant – a variant of GraphicalProton backdoor recently introduced by the SVR that forgoes using cloud-based services as a C2 channel and instead relies on HTTP request. To legitimize the C2 channel, SVR used a re-registered expired domain set up with dummy WordPress website. Execution of HTTPS variant of GraphicalProton is split into two files – stager and encrypted binary file that contains further code.
MITRE ATT&CK TACTICS AND TECHNIQUES
See below tables for all referenced threat actor tactics and techniques in this advisory. For additional mitigations, see the Mitigations section.
SVR cyber actors use a variant that uses DLL hijackingin Zabbix as a means to start execution (and potentially provide long-term, hard-to-detect access) and a variant that masks itself within vcperf, an open-source C++ build analysis tool from Microsoft.
When communicating with cloud services, GraphicalProton generates a randomly named directory which is used to store infection-specific BMP files – with both commands and results.
In a few specific cases, the SVR used the SharpChromium tool to obtain sensitive browser data such as session cookies, browsing history, or saved logins.
SVR cyber actors use these built-in commands to perform host reconnaissance: whoami /priv, whoami / all, whoami / groups, whoami / domain to perform user discovery.
SVR cyber actors may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.
In selected environments, the SVR used an additional tool named, “rr.exe”—a modified open source reverse socks tunneler named Rsockstunm—to establish a tunnel to the C2 infrastructure.
Table 11: SVR Cyber Actors ATT&CK Techniques for Enterprise: Exfiltration
SVR cyber actors may steal data by exfiltrating it over an existing C2 channel. Stolen data is encoded into normal communications using the same protocol as C2 communications.
SVR cyber actors use OneDrive and Dropbox to exfiltrate data to their C2 station.
INDICATORS OF COMPROMISE
Note: Please refer to Appendix B for a list of IOCs.
VICTIM TYPES
As a result of this latest SVR cyber activity, the FBI, CISA, NSA, SKW, CERT Polska, and NCSC have identified a few dozen compromised companies in the United States, Europe, Asia, and Australia, and are aware of over a hundred compromised devices though we assess this list does not represent the full set of compromised organizations. Generally, the victim types do not fit into any sort of pattern or trend, aside from having an unpatched, Internet-reachable JetBrains TeamCity server, leading to the assessment that SVR’s exploitation of these victims’ networks was opportunistic in nature and not necessarily a targeted attack. Identified victims included: an energy trade association; companies that provide software for billing, medical devices, customer care, employee monitoring, financial management, marketing, sales, and video games; as well as hosting companies, tools manufacturers, and small and large IT companies.
DETECTION METHODS
The following rules can be used to detect activity linked to adversary activity. These rules should serve as examples and adapt to each organization’s environment and telemetry.
SIGMA Rules
title: Privilege information listing via whoami description: Detects whoami.exe execution and listing of privileges author: references: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami date: 2023/11/15 logsource: category: process_creation product: windows detection: selection: Image|endswith: - 'whoami.exe' CommandLine|contains: - 'priv' - 'PRIV' condition: selection falsepositives: legitimate use by system administrator
title: DC listing via nltest description: Detects nltest.exe execution and DC listing author: references: date: 2023/11/15 logsource: category: process_creation product: windows detection: selection: Image|endswith: - 'nltest.exe' CommandLine|re: '.*dclist\:.*|.*DCLIST\:.*|.*dsgetdc\:.*|.*DSGETDC\:.*' condition: selection falsepositives: legitimate use by system administrator
title: DLL execution via WMI description: Detects DLL execution via WMI author: references: date: 2023/11/15 logsource: category: process_creation product: windows detection: selection: Image|endswith: - 'WMIC.exe' CommandLine|contains|all: - 'call' - 'rundll32' condition: selection falsepositives: legitimate use by software or system administrator
title: Process with connect and pass as args description: Process with connect and pass as args author: references: date: 2023/11/15 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'pass' - 'connect' condition: selection falsepositives: legitimate use of rsockstun or software with exact same arguments
title: Service or Drive enumeration via powershell description: Service or Drive enumeration via powershell author: references: date: 2023/11/15 logsource: category: ps_script product: windows detection: selection_1: ScriptBlockText|contains|all: - 'Get-WmiObject' - '-Class' - 'Win32_Service' selection_2: ScriptBlockText|contains|all: - 'Get-WindowsDriver' - '-Online' - '-All' condition: selection_1 or selection_2 falsepositives: legitimate use by system administrator
title: Compressing files from temp to temp description: Compressing files from temp\ to temp used by SVR to prepare data to be exfiltrated references: author: date: 2023/11/15 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|re: '.*Compress\-Archive.*Path.*Windows\\[Tt]{1}emp\\[1-9]{1}.*DestinationPath.*Windows\\[Tt]{1}emp\\.*' condition: selection
title: DLL names used by SVR for GraphicalProton backdoor description: Hunts for known SVR-specific DLL names. references: author: date: 2023/11/15 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - 'AclNumsInvertHost.dll' - 'ModeBitmapNumericAnimate.dll' - 'UnregisterAncestorAppendAuto.dll' - 'DeregisterSeekUsers.dll' - 'ScrollbarHandleGet.dll' - 'PerformanceCaptionApi.dll' - 'WowIcmpRemoveReg.dll' - 'BlendMonitorStringBuild.dll' - 'HandleFrequencyAll.dll' - 'HardSwapColor.dll' - 'LengthInMemoryActivate.dll' - 'ParametersNamesPopup.dll' - 'ModeFolderSignMove.dll' - 'ChildPaletteConnected.dll' - 'AddressResourcesSpec.dll' condition: selection
title: Sensitive registry entries saved to file description: Sensitive registry entries saved to file author: references: date: 2023/11/15 logsource: category: process_creation product: windows detection: selection_base: Image|endswith: - 'reg.exe' CommandLine|contains: 'save' CommandLine|re: '.*HKLM\\SYSTEM.*|.*HKLM\\SECURITY.*|.*HKLM\\SAM.*' selection_file: CommandLine|re: '.*sy\.sa.*|.*sam\.sa.*|.*se\.sa.*' condition: selection_base and selection_file
Note: These rules are meant for threat hunting and have not been tested on a larger dataset.
MITIGATIONS
The FBI, CISA, NSA, SKW, CERT Polska, and NCSC assess the scope and indiscriminate targeting of this campaign poses a threat to public safety and recommend organizations implement the mitigations below to improve organization’s cybersecurity posture. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.
Apply available patches for CVE-2023-42793 issued by JetBrains TeamCity in mid-September 2023, if not already completed.
Monitor the network for evidence of encoded commands and execution of network scanning tools.
Ensure host-based anti-virus/endpoint monitoring solutions are enabled and set to alert if monitoring or reporting is disabled, or if communication is lost with a host agent for more than a reasonable amount of time.
Require use of multi-factor authentication [CPG 1.3] for all services to the extent possible, particularly for email, virtual private networks, and accounts that access critical systems.
Organizations should adopt multi-factor authentication (MFA) as an additional layer of security for all users with access to sensitive data. Enabling MFA significantly reduces the risk of unauthorized access, even if passwords are compromised.
Keep all operating systems, software, and firmware up to date. Immediately configure newly-added systems to the network, including those used for testing or development work, to follow the organization’s security baseline and incorporate into enterprise monitoring tools.
Audit log files to identify attempts to access privileged certificates and creation of fake identity providers.
Deploy software to identify suspicious behavior on systems.
Deploy endpoint protection systems with the ability to monitor for behavioral indicators of compromise.
Use available public resources to identify credential abuse with cloud environments.
Configure authentication mechanisms to confirm certain user activities on systems, including registering new devices.
VALIDATE SECURITY CONTROLS
In addition to applying mitigations, FBI, CISA, NSA, SKW, CERT Polska, and NCSC recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. FBI, CISA, NSA, SKW, CERT Polska, and NCSC recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.
To get started:
Select an ATT&CK technique described in this advisory (see previous tables).
Align your security technologies against the technique.
Test your technologies against the technique.
Analyze your detection and prevention technologies’ performance.
Repeat the process for all security technologies to obtain a set of comprehensive performance data.
Tune your security program, including people, processes, and technologies, based on the data generated by this process.
FBI, CISA, NSA, SKW, CERT Polska, and NCSC recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.
The information in this report is being provided “as is” for informational purposes only. FBI, CISA, NSA, SKW, CERT Polska, and NCSC do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI, CISA, NSA, SKW, CERT Polska, and NCSC.
VERSION HISTORY
December 12, 2023: Initial version.
APPENDIX A – INDICATORS OF COMPROMISE CVE-2023-42793
On a Windows system, the log file C:\TeamCity\logs\teamcity-server.log will contain a log message when an attacker modified the internal.properties file. There will also be a log message for every process created via the /app/rest/debug/processes endpoint. In addition to showing the command line used, the user ID of the user account whose authentication token was used during the attack is also shown. For example:
[2023-09-26 11:53:46,970] INFO - ntrollers.FileBrowseController - File edited: C:\ProgramData\JetBrains\TeamCity\config\internal.properties by user with id=1 [2023-09-26 11:53:46,970] INFO - s.buildServer.ACTIVITIES.AUDIT - server_file_change: File C:\ProgramData\JetBrains\TeamCity\config\internal.properties was modified by "user with id=1" [2023-09-26 11:53:58,227] INFO - tbrains.buildServer.ACTIVITIES - External process is launched by user user with id=1. Command line: cmd.exe "/c whoami"
An attacker may attempt to cover their tracks by wiping this log file. It does not appear that TeamCity logs individual HTTP requests, but if TeamCity is configured to sit behind a HTTP proxy, the HTTP proxy may have suitable logs showing the following target endpoints being accessed:
/app/rest/users/id:1/tokens/RPC2 – This endpoint is required to exploit the vulnerability.
/app/rest/users – This endpoint is only required if the attacker wishes to create an arbitrary user.
/app/rest/debug/processes – This endpoint is only required if the attacker wishes to create an arbitrary process.
Minister for Foreign Affairs Dr Vivian Balakrishnan visited Cook Islands from 9 to 11 November 2023 to attend the 52nd Pacific Islands Forum (PIF) Leaders Meeting, marking the first time that Singapore participated in the PIF Leaders Meeting as a Dialogue Partner.
Minister Balakrishnan delivered remarks at the 2050 Pacific Prosperity High-Level Thematic Dialogue on 10 November 2023. He highlighted that Singapore viewed relations with the PIF as strategic. As fellow Small Island Developing States, Singapore and the Pacific Islands share a commitment to tackling global challenges, particularly the existential issue of climate change. Over the past 30 years, Singapore has shared our development experience with more than 5,800 Pacific officials under the Singapore Cooperation Programme.
Minister Balakrishnan announced the launch of a three-year customised technical assistance package for the Pacific named the “Singapore-Pacific Resilience and Knowledge Sharing” (SPARKS) package. The SPARKS package comprises courses in climate resilience, cybersecurity and international law. These courses will support the Pacific’s capacity building efforts in priority areas under the PIF’s 2050 Strategy for the Blue Pacific Continent, the blueprint for charting the region’s future. The transcript of Minister Balakrishnan’s remarks and a factsheet on the SPARKS package are at Annexes A and B.
During his visit, Minister Balakrishnan met several leaders from the Pacific, including PIF Chair and Cook Islands Prime Minister Mark Brown, Fiji Prime Minister Sitiveni Rabuka, French Polynesia President Moetai Brotherson, Kiribati President Taneti Maamau, New Caledonia President Louis Mapou, Tonga Prime Minister Siaosi Sovaleni, Palau Minister of State for Foreign Affairs Gustav Aitaro, Solomon Islands Minister for Foreign Affairs and External Trade Jeremiah Manele, and PIF Secretary General Henry Puna. Minister Balakrishnan had good discussions with these leaders on the Pacific’s priorities as well as how Singapore can work with them both bilaterally and multilaterally.
https://spinsafe.com/wp-content/uploads/2023/11/IMG_6788.ashx.jpeg11502048SecureTechhttps://spinsafe.com/wp-content/uploads/2024/01/SS-Logo.svgSecureTech2023-11-11 10:30:082023-11-11 10:30:08Visit by Minister for Foreign Affairs Dr Vivian Balakrishnan to the Cook Islands for the 52nd Pacific Islands Forum Leaders Meeting, 9 to 11 November 2023
Deputy National Security Advisor Anne Neuberger discusses international cyber cooperation initiatives to improve resilience to ransomware, efforts to disrupt ransomware and pursue those responsible for its proliferation, and countering illicit finance that underpins the ransomware ecosystem.
SANGER: Well, good afternoon. I’m David Sanger from the New York Times. Great to see so many old friends in the crowd here. And we are joined by many others who are watching on video. And I’m delighted to be here with Anne Neuberger, the deputy national security adviser for cyber and emerging technology. Anne has really sort of revolutionized the way the White House thinks and deals with all of these issues. So I am delighted that she’s here.
So here’s how it’s going to unfold today. Anne and I are going to talk for about a half an hour on the new ransomware initiative she has, current ransomware issues, and a few other related cyber issues. And then at about 1:30, halfway through, we’re going to invite questions from the audience and from our extended audience as well. I want to remind everybody, boy, this makes me so happy to say, Anne, this is all on the record. (Laughter.) How often do we have a chance to talk on the record? This is great. And then we will proceed. That means that not only are Anne’s answers on the record, it means your questions are on the record. So think about that for a moment. (Laughs.) So.
NEUBERGER: David’s joyfully enjoying this moment.
SANGER: Yeah. (Laughs.) So, Anne, let’s just go back to the beginning of the administration when you were—after a quite remarkable career, which you can all read about in the materials in front of you, as a White House fellow, as the official of the NSA working on commercial issues, defensive issues, offensive issues—you end up coming to the White House. And even before President Biden is in office, while he is still in Delaware under COVID restrictions. Sort of hard to remember what this was all like now. The first big issue he is dealing with, apart from the fact that his predecessor was trying to overturn the election, was SolarWinds, right? We had the Russians having come in to the—to the…
https://spinsafe.com/wp-content/uploads/2023/10/ransomware.jpg9001600SecureTechhttps://spinsafe.com/wp-content/uploads/2024/01/SS-Logo.svgSecureTech2023-10-25 12:30:072023-10-25 12:30:07Countering the Ransomware Threat | Council on Foreign Relations